Messages are being delivered to internal users even though the sending IP address is marked as bad by one or more Bad Sender IP lists.
Errors similar to the following appear in the Messaging Gateway (SMG) messages log:
(unexpected RCODE REFUSED) resolving 'XXX/A/IN': 8.8.8.8#53
Confirm that the DNS servers configured in Administration > Configuration > hostname > DNS / Time are not rate limited. While public DNS servers are useful for normal web browsing and individual user internet activities, mission critical infrastructure like Messaging Gateway scannes should not be configured to use rate limited DNS servers which may cause problems with normal SMG operations.
Please see Using public DNS servers for Messaging Gateway for more details.